Privacy notice

Early-access draft. Last updated 30 October 2026.

This explains what Growth HQ stores about you, why, who else sees it, and how to have it removed. It is written to be read, not to hide things.

What we store

Your account: your email address and a one-way hash of your password (Argon2id; we cannot read your password), sign-in sessions, and the time and browser type of sign-ins.
Your organization's data: products, settings, tasks, reports, conversations with the AI employees, a record of every run and every action the team took (including what was refused), usage and cost records, and the memory the team keeps about your work.
Credentials you add: encrypted with a key per organization, never shown again, never put in prompts, logs or messages.

Why

Only to run the service for you: to sign you in, to do the work you set up, to show you what happened, to keep it safe and to fix problems. We do not sell your data, show ads, or use your data to train models.

Who else handles it

OpenRouter and the model provider it routes to receive the text of the AI employees' prompts (your instructions, the relevant parts of your data, and your chat messages) to produce answers. We ask for no data collection or retention by the provider where it offers that choice.
Resend delivers the emails we send you (confirmation and password-reset links, a note when something needs your decision, and a morning summary you can switch off under Account).
Cloudflare carries traffic between your browser and this site.
The services you connect (for example GitLab or Google) receive requests from your team, using your credentials, as you configured.

Everything else runs on the server this site is hosted on. We do not use third-party analytics or advertising cookies.

Cookies

One cookie, to keep you signed in. It is not used for tracking.

How long we keep it

The details of what the team asked each tool to do (which tool, who asked, and what they passed to it) are kept for seven days, so that a change to a rule can be tried on the team's recent real calls before anyone approves it. Account and organization data is kept until you or your organization's owner asks us to delete it. Backups are encrypted and rotated, so deleted data disappears from them within about two weeks.

Security

Each organization's data is separated in the database by row-level security; credentials are encrypted; the team's tools run in locked-down containers; every action goes through checks and is logged. No system is perfectly secure; we will tell you promptly if we learn that your data was exposed.

Your rights

You can ask to see, correct, export or delete the personal data we hold about you, and to delete your organization. Ask the person who runs this site; where the law gives you rights over your data (for example under GDPR or similar laws), those apply.